Assessing your organisation
We review how your organisation manages IT risk, incidents and reliance on providers. We compare documentation with practice and the agreed scope of DORA requirements. You receive a report, priorities and proposed changes to discuss with management and IT. We tailor the scope for financial entities subject to DORA or ICT suppliers responding to the requirements of their financial-sector customers.
Trusted by
A security policy alone does not show whether a team can report an incident, restore a service or respond to a provider problem. We speak with business, IT and compliance owners. We review specified systems, contracts, test results and records of completed activities, not just document titles. Within the agreed scope, we examine the ICT risk register and assessments, management approval of the risk framework, the safeguards selected and the responsible team’s competence.
The report separates findings from remediation work. Implementation, procedures and tests can be commissioned separately within an agreed scope.
TÜV NORD Polska has certified Virtline’s information security management system to PN-EN ISO/IEC 27001:2023-08. The published certificate states its scope and validity. The certificate covers Virtline’s management system and does not confirm a customer’s compliance with DORA.
View Virtline’s certificateWe first agree what will be assessed and against which requirements. System access, test scope and secure handling of confidential material are defined before work starts.
We establish your business activities, important services and IT providers. We agree the requirements covered, materials and access limitations. We identify the people responsible for each area who can explain the documentation and how the safeguards work.
We examine IT risk management, incidents, recovery, testing and provider oversight. Documents are compared with settings and available records of activities. For incidents, we examine detection, classification, records, timeliness of reporting required by law and under contracts and lessons learned. We also review how the business verifies threat warnings and acts on them when it uses information sharing, ISAC groups or threat intelligence sources. Statutory reporting deadlines cannot be negotiated in a contract.
We organise findings by significance and explain their basis. Your business can clarify circumstances and supply missing material before further work is agreed.
We discuss priorities with management and the team. We establish who will make changes and how they will be checked; later implementation or reassessment has a separate scope.
Practical scope
The report should support decisions. Each finding should identify its basis, significance for the business and a proposed next step.
The services, systems, documents and providers included. We clearly identify areas not examined and cases where missing information prevented verification. For the testing programme, we consider scope, frequency and tester competence. For providers, we review the service register, assessment before engagement and contract terms on audit rights, escalation, processing locations and service exit.
Identified gaps and risks to business operations. We distinguish missing documentation from ineffective practice and identify the records and tests supporting each finding.
Proposed actions and their sequence. We agree owners, dependencies and verification with your business rather than imposing the same fixed 30-day plan on every organisation.
A meeting with decision-makers and those responsible for the work. We explain consequences, additional work and matters requiring legal advice or further testing.
DORA has applied since 17 January 2025, but the relevant obligations depend on the entity and its activities. Our report describes the assessment and its limitations. It does not replace a supervisory decision, legal advice or management responsibility for compliance.
Source
The official text of the DORA Regulation in EUR-Lex.
Open sourceThese roles should not be equated. A financial entity remains responsible for its DORA requirements when outsourcing services. Providers may receive contractual requirements from clients; designated critical providers are subject to separate oversight. The scope for a particular business must be established before assessment.
No. DORA sets sector-specific requirements for financial entities within its scope, including IT risk and incidents. A provider being subject to NIS2 does not remove DORA contract and third-party risk requirements for the financial entity. A statement about NIS2 alone does not establish DORA compliance.
TLPT (Threat-Led Penetration Testing) uses information about real cyber threats to guide penetration tests. Technical tests are scoped separately. A documentation review, a conventional penetration test and formal TLPT are different activities. We do not present an ordinary application test as TLPT or promise its acceptance by a supervisor.
We do not assume that access is needed. We agree necessary materials, permissions and secure sharing. Where explanations, samples or anonymised records suffice, data access is limited. Any inability to verify an area is recorded in the report.
Tell us what your business does, what you need assessed and whether a client or supervisor has set a deadline. Mention previous reviews and main systems. Do not send confidential contracts through the form.
Discuss a DORA audit